Security readout for executives and security teams
Plain-English summary
This Fortinet SSL VPN issue can let an unauthenticated attacker change a web portal user’s password. For exposed VPN systems, that can become a direct account-takeover risk without stolen credentials or user interaction. CISA lists it as known exploited, so affected internet-facing appliances deserve urgent attention.
Executive priority
Treat this as urgent for any internet-facing Fortinet SSL VPN portal. The business risk is unauthorized VPN account control, which can support broader network intrusion. Asset owners should confirm exposure and complete vendor-guided remediation promptly.
Technical view
CVE-2018-13382 is an improper authorization flaw in FortiOS and FortiProxy SSL VPN web portal handling. A specially crafted HTTP request can modify an SSL VPN web portal user password without authentication. The CVSS 3.1 score is 9.1 with network access, low complexity, no privileges, and no user interaction.
Likely exposure
Organizations may be exposed if they run Fortinet FortiOS 6.0.0-6.0.4, 5.6.0-5.6.8, 5.4.1-5.4.10, or FortiProxy 2.0.0, 1.2.0-1.2.8, 1.1.0-1.1.6, 1.0.0-1.0.7 with the SSL VPN web portal enabled, especially on internet-facing appliances.
Exploitation context
CISA KEV inclusion supports active exploitation in the wild. The provided sources do not include exploit-volume details, actor attribution, or confirmed victim patterns. The vulnerability is high-impact because exploitation does not require authentication, privileges, or user interaction.
Researcher notes
The source bundle identifies affected version ranges, CWE-863, CVSS vector, Fortinet advisories, and CISA KEV status. It does not provide safe detection indicators, exploit telemetry, or exact fixed version details. Avoid assuming affected configurations beyond SSL VPN web portal exposure.
Mitigation direction
- Identify FortiOS and FortiProxy SSL VPN web portal deployments in the affected version ranges.
- Review Fortinet advisory FG-IR-18-389 for fixed releases and upgrade guidance.
- Prioritize internet-facing SSL VPN appliances before internal-only deployments.
- Follow CISA KEV-driven remediation urgency for affected systems.
- Review SSL VPN users for suspicious password changes after remediation.
Validation and detection
- Inventory FortiOS and FortiProxy versions against the affected ranges.
- Confirm whether the SSL VPN web portal is enabled and externally reachable.
- Verify remediation against Fortinet’s advisory, not only package version labels.
- Check authentication logs for unusual SSL VPN password-change activity.
- Confirm no exposed appliance remains on listed vulnerable versions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-863: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2018-13382 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N3.95.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://fortiguard.com/advisory/FG-IR-18-389CVE reference · x_refsource_CONFIRM
- https://www.fortiguard.com/psirt/FG-IR-20-231CVE reference · x_refsource_CONFIRM
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-13382CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.